Session not being destroyed with session_destroy ()?

Question

Session not being destroyed with session_destroy ()?

Navigation

#1 by (2 votes)
#2 by (2 votes)
#3 by (1 votes)

0

I soon in my session, I created a page logout.php to destroy the session. So far so good I can download but when I click the back button of the browser I enter the session again. How do I destroy the session?

logout.php

    ?>
    <script>alert("Logout efetuado com sucesso");
    window.location="http://dominio.com/area/login.php";
    </script>     


    <?php

    //header("Location:http://dominio.com/area/index.php"); exit; // Redireciona o visitante
?>

access.php where my session was valid

 $usuario = mysql_real_escape_string($_POST['login']);
$senha = mysql_real_escape_string($_POST['senha']);

// Validação do usuário/senha digitados
$sql = "SELECT 'id_user', 'nome', 'nivel','id_franquia' FROM 'usuario1' WHERE ('nome' = '".$usuario ."') AND ('senha' = '". $senha ."') LIMIT 1 ";
$query = mysql_query($sql);
if (mysql_num_rows($query) != 1) {
    // Mensagem de erro quando os dados são inválidos e/ou o usuário não foi encontrado
   ?> <script>alert("Login inválido! Tente novamente");
        window.location="http://dominio.com/area/login.php";       
   </script><?php
   //header("Location:http://dominio.com/area/login.php");
} else {
    // Salva os dados encontados na variável $resultado
    $resultado = mysql_fetch_assoc($query);

    // Se a sessão não existir, inicia uma
    if (!isset($_SESSION)) session_start();

    // Salva os dados encontrados na sessão
    $_SESSION['UsuarioId'] = $resultado['id_user'];
    $_SESSION['UsuarioNome'] = $resultado['nome'];
    $_SESSION['UsuarioNivel'] = $resultado['nivel'];
    $_SESSION['UsuarioFranquia'] = $resultado['id_franquia'];

    if($_SESSION['UsuarioNivel'] ==1){
        header("Location:http://dominio.com/area/admin/admin.php"); 
    }else if($_SESSION['UsuarioNivel'] ==2){
        header("Location:http://dominio.com/area/editor/editor.php");
    }else if($_SESSION['UsuarioNivel'] ==3){
        header("Location:http://dominio.com/area/usuario/usuario.php");
    }

page that I'm targeting

editor.php

<?php


if (!isset($_SESSION)) 
session_cache_expire(10);
session_start();

$nivel_necessario = 2;

    // Verifica se não há a variável da sessão que identifica o usuário
if (!isset($_SESSION['UsuarioId']) && ($_SESSION['UsuarioNivel'] !=$nivel_necessario)) {
    // Destrói a sessão por segurança
    session_destroy();
    // Redireciona o visitante de volta pro login
    header("Location:http://dominio.com/area/login.php"); exit;
}
$logado = $_SESSION['UsuarioNome'];
?>

php

asked by anonymous 23.07.2014 / 18:45

3 answers

2

Since no one answered until now, I'm going to give you a solution that I do not know is the most valid one.

In the "Editor.php" header insert:

<script type="text/javascript">
window.history.go(1);
</script>

This code does not allow the user to go back to the page.

23.07.2014 / 21:51

2

When you click Exit, a new page is loaded by logging out the user. If it clicks back, the session will NOT be redone, it's just the browser's cache. If it returned to a page with options to edit the profile - for example - and submit the form, when the page is updated to perform the action, it will check that the user is not logged in.

. Maybe you can change the cache time to resolve

23.07.2014 / 23:56

It is possible to assign the value of a JavaScript variable, to one in ASP Updating data from a div?

score 1 · Accepted Answer

Staff solved the problem with the help of Rene and Papa Charlie. First I used the javascript indicated by Rene this code does not leave page back. This code has to be placed on every page you want to protect from unauthorized access.

    <script type="text/javascript">
        window.history.go(1);
    </script>

Then I used the time control in the section. I seted the time in the file that tests for access then my access.php file looks like this.

     if (!isset($_SESSION)) session_start();

    // Salva os dados encontrados na sessão
    $_SESSION['UsuarioId'] = $resultado['id_user'];
    $_SESSION['UsuarioNome'] = $resultado['nome'];
    $_SESSION['UsuarioNivel'] = $resultado['nivel'];
    $_SESSION['UsuarioFranquia'] = $resultado['id_franquia'];
    $_SESSION["Tempo"] = time() + 60*2;

    if($_SESSION['UsuarioNivel'] ==1){
        header("Location:http://dominio.com/area/admin/admin.php"); 
    }else if($_SESSION['UsuarioNivel'] ==2){
        header("Location:http://dominio.com/area/editor/editor.php");
    }else if($_SESSION['UsuarioNivel'] ==3){
        header("Location:http://dominio.com/area/usuario/usuario.php");
    }

And then text the time on each page that I want to protect. Page publisher looks like this.

    if ( isset( $_SESSION["Tempo"] ) ) { 
       if ($_SESSION["Tempo"] < time() ) { 
           session_unset();
           echo "Seu tempo Expirou!";
           //Redireciona para login
           header("Location:http://domino.com/area/login.php");
    } else {

        //Seta mais tempo 60 segundos
        $_SESSION["sessiontime"] = time() + 60;
    }
  } else { 
      session_unset();
    //Redireciona para login

}